Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
New Reactors Programme
GDA close-out for the AP1000 reactor
GDA Issue GI-AP1000-CE-04: Fuel Handling Area – Secondary Containment Leak Detection and Collection System
Assessment Report: ONR-NR-AR-16-042 Revision 0 March 2017
Office for Nuclear Regulation Page 1 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
© Office for Nuclear Regulation, 2017 If you wish to reuse this information, visit www.onr.org.uk/copyright for details. Published 03/17
For published documents, the electronic copy on the ONR website remains the most current publicly available version and copying or printing renders this document uncontrolled.
Office for Nuclear Regulation Page 2 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
EXECUTIVE SUMMARY
Westinghouse is the reactor design company for the AP1000® reactor. Westinghouse completed Generic Design Assessment (GDA) Step 4 in 2011 and paused the regulatory process. It achieved an Interim Design Acceptance Confirmation (IDAC) which had 51 GDA issues attached to it. These issues require resolution prior to award of a Design Acceptance Confirmation (DAC) and before any nuclear safety-related construction can begin on site. Westinghouse re-entered GDA in 2014 to close the 51 issues.
This report is the Office for Nuclear Regulation’s (ONR’s) assessment of the Westinghouse AP1000 reactor design in the area of civil engineering. Specifically this report addresses GDA Issue GI-AP1000-CE-04: Fuel Handling Area, Secondary Containment Leak Detection and Collection System. This GDA issue arose in Step 4 due to: the possibility that minor leakage from the spent fuel pools (SFPs) in the fuel handling area may be undetected for a period of time. This type of leak has the potential to damage the internal structure of the CA structural modules, but also to eventually migrate to the external environment. The main concern is that these potential leakage paths could be undetected for a long period of time (chronic leaks), and that the extent of the resulting damage / contamination, if finally detected, would not be quantifiable; the ONR requirement that minor leakages from the SFPs in the fuel handling area are prevented or detected and managed in a suitable manner as and when they might occur; and the ONR expectations that a modern design with at least two barriers is provided for a spent fuel pool to achieve defence in depth in line with the ONR Safety Assessment Principles (SAPs). GDA Issue GI-AP1000-CE-04 comprises four actions, each with sub-items to be addressed. The Westinghouse GDA Issue resolution plan stated that its approach to closing GDA Issue GI-AP1000-CE-04 Action 1, Action 2 and Action 3 was to: provide an overview of the SFP, RC wall and CA20 structural module, including information regarding the primary and secondary leak barriers and the systems in place for leakage detection; provide a description of welds and system of leak chases to prevent borated water from getting behind the various pool liner plates as well as a description of the methods used to detect leakage and identify the location of the leak; and undertake an As Low as Reasonably Practicable (ALARP) assessment to evaluate whether any additional leakage detection means would be ALARP. The ALARP assessment would include an evaluation of the existing design and potential design alternatives. The Westinghouse GDA Issue resolution plan stated that its approach to closing GDA Issue GI-AP1000-CE-04 Action 4 was to: demonstrate the corrosion rate of the carbon steel if it were exposed to water from the SFP; and demonstrate that minor leakage through the spent fuel pool liner will not cause a structural failure of the SFP. My assessment conclusions are: Westinghouse’s response has demonstrated that its design incorporates a suitable leak detection/collection system to the secondary barrier formed by the steel concrete composite (SC) construction in the CA20 walls and floors.
Office for Nuclear Regulation Page 3 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
Westinghouse’s response has demonstrated that its design incorporates a suitable leak detection / collection system to the secondary barrier formed by the reinforced concrete wall which is cast up against the single plate stainless steel liner to the west wall of module CA20. Westinghouse’s response has demonstrated that their design incorporates a suitable leak detection/collection system to the secondary barrier formed by the RC wall which is cast between the north single plate stainless steel liner of the SFP and the shield building. Westinghouse has adequately evaluated the effect of borated water from potential leakage from SFP on mild steel components within the CA20 module. Westinghouse has undertaken a suitable evaluation on the potential of the corrosion rates of mild steel reinforcing bars subject to potential leaks from the pools and an evaluation of the effects on the structural capacity of the same walls and slabs. My judgement is based upon the following factors: compliance with ONR SAPs; relevant good practice (RGP) is generally met; and there are some opportunities, identified as Assessment Findings, for a licensee to make improvement to reduce risks to ALARP. The following matters remain, which are for a future licensee to consider and take forward in its site-specific safety submissions. These matters do not undermine the generic safety submission and require licensee input / decision. Demonstrate the design of joints between the floor liner plates in the HSC floors satisfies the two barrier principle. Provide a conservative analysis of the corrosion rate used to assess the effects of highly borated water on steel reinforcement in the SFP. Establish a site-specific groundwater monitoring programme and for the full life cycle of the facility. Demonstrate that the design of the SFP remains robust in areas where bimetallic corrosion can occur. Demonstrate that the analysis of the effects of borated water on concrete used in GDA is applicable to the site specific cement chemistry and aggregate minerology. In summary I am satisfied that GDA Issue GI-AP1000-CE-04: Fuel Handling Area, Secondary Containment Leak Detection and Collection System can be closed.
The licensee shall demonstrate the design satisfies the two barrier principle at joints between the floor liner plates in the half steel-concrete composite floors.
Office for Nuclear Regulation Page 4 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
LIST OF ABBREVIATIONS
ABS American Bureau of Shipping ALARP As Low As Reasonably Practicable ACI American Concrete Institute BS British Standard CA (Structural Module Naming Convention) CE Civil Engineering CNWRA Centre for Nuclear Waste Regulatory Analysis DAC Design Acceptance Confirmation DCR Design to Capacity Ratio GDA Generic Design Assessment HSC Half Steel-Concrete Composite IDAC Interim Design Acceptance Confirmation IFF Initiating Fault Frequency NDCV Nominal Design Corrosion Values NDE Non-Destructive Examination ONR Office for Nuclear Regulation PCSR Pre-Construction Safety Report RGP Relevant Good Practice RP Requesting Party RC Reinforced Concrete RQ Regulatory Query SAP Safety Assessment Principle SFAIRP So Far As Is Reasonably Practicable SFP Spent Fuel Pool SFS Spent Fuel Pool Cooling System SC Steel-Concrete Composite SSE Safe Shutdown Earthquake TAG Technical Assessment Guide THORP Thermal Oxide Reprocessing Plant TQ Technical Query TSC Technical Support Contractor UT Universal Testing UK United Kingdom WLS Liquid Radwaste System WRS Radioactive Waste Drain System
Office for Nuclear Regulation Page 5 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
TABLE OF CONTENTS
1 INTRODUCTION ...... 7 1.1 Background ...... 7 1.2 Scope ...... 7 1.3 Method ...... 8 2 ASSESSMENT STRATEGY ...... 8 2.1 Pre-Construction Safety Report (PCSR) ...... 9 2.2 Standards and Criteria ...... 9 2.3 Use of Technical Support Contractors (TSCs) ...... 11 2.4 Integration with Other Assessment Topics ...... 11 2.5 Out of Scope Items ...... 11 3 REQUESTING PARTY’S RESPONSE TO GDA ISSUE GI-AP1000-CE-04 ...... 13 3.1 Westinghouse Response to Action GI-AP1000-CE-04.A1 ...... 13 3.2 Westinghouse Response to Action GI-AP1000-CE-04.A2 ...... 13 3.3 Westinghouse Response to Action GI-AP1000-CE-04.A3 ...... 13 3.4 Westinghouse Response to Action GI-AP1000-CE-04.A4 ...... 14 3.5 Documents Submitted ...... 14 4 ONR ASSESSMENT OF GDA ISSUE GI-AP1000-CE-04 ...... 15 4.1 Scope of Assessment Undertaken ...... 15 4.2 Assessment of Action GI-AP1000-CE-04.A1 ...... 15 4.3 Assessment of Action GI-AP1000-CE-04.A2 ...... 17 4.4 Assessment of Action GI-AP1000-CE-04.A3 ...... 22 4.5 Assessment of Action GI-AP1000-CE-04.A4 ...... 23 4.6 Assessment Findings...... 30 4.7 Minor Shortfalls...... 30 5 CONCLUSIONS...... 31 6 REFERENCES ...... 32
Table(s)
Table 1: Westinghouse summary of actions in Resolution Plan GI-AP1000-CE-04 Table 2: Key SAPs used within assessment Table 3: TAGs used within assessment Table 4: Standards and guidance used within assessment
Annex(es)
Annex 1: Assessment Findings to be addressed during the Forward Programme – GDA Issue GI-AP1000-CE-04
Office for Nuclear Regulation Page 6 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
1. Westinghouse Electric Company completed Generic Design Assessment (GDA) Step 4 in 2011 and paused the regulatory process. It achieved an interim Design Acceptance Confirmation (IDAC) which had 51 GDA issues attached to it. These issues require resolution prior to award of a Design Acceptance Confirmation (DAC) and before any nuclear safety-related construction can begin on site. Westinghouse re- entered GDA in 2014 to close the 51 issues.
2. This report is the Office for Nuclear Regulation’s (ONR’s) assessment of the Westinghouse AP1000 reactor design in the area of civil engineering (CE). Specifically, this report addresses GDA Issue GI-AP1000-CE-04: Fuel Handling Area, Secondary Containment Leak Detection and Collection System.
3. The related GDA Step 4 report is published on our website (http://www.onr.org.uk/new-reactors/ap1000/reports.htm), and this provides the assessment underpinning the GDA issue. Further information on the GDA process in general is also available on our website (http://www.onr.org.uk/new- reactors/index.htm).
4. The scope of this assessment is detailed in Assessment Plan ONR-GDA-AP-14-008 Revision 2 (Ref. 2).
5. The scope of GI-AP1000-CE-04 (Ref. 1) requires that minor leakages from the spent fuel pools (SFPs) in the fuel handling area are prevented or detected and managed in a suitable manner as and when they might occur. Undetected leaks have the potential to damage the internal structure of the CA modules and to ultimately migrate to the external environment.
6. Civil pool structures that are required to contain plant water must employ multiple barriers. The number of barriers is dependent on the radiological hazard, but in a modern design ONR expects at least two barriers to be provided for an SFP to achieve defence-in-depth.
7. The scope of this assessment is focused on the actions agreed between Westinghouse and ONR as detailed in the Resolution Plan GI-AP1000-CE-04 (Ref. 3). The issue comprises four actions summarised in Table 1.
Table 1: Westinghouse summary of actions in Resolution Plan GI-AP1000-CE-04 (Ref. 3)
Action Description
GI-AP1000-CE-04.A1 Secondary containment leak detection and collection system for Module CA20 steel & concrete composite (SC) walls and half steel & concrete composite (HSC) floors.
Provide a leak detection/collection system to the secondary barrier formed by the CA SC construction.
Office for Nuclear Regulation Page 7 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
GI-AP1000-CE-04.A2 Secondary containment leak detection and collection system for west reinforced concrete (RC) wall to transfer canal.
Provide a leak detection/collection system to the secondary barrier formed by the RC wall which is cast up against the single plate stainless steel liner to the west wall of module CA20.
GI-AP1000-CE-04.A3 Secondary containment leak detection and collection system for north wall of SFP.
Provide a leak detection/collection system to the secondary barrier formed by the RC wall which is cast between the north single plate stainless steel liner of the SFP and the shield building.
GI-AP1000-CE-04.A4 Evaluate the effect of borated water from potential leakage from SFP on mild steel components within CA20.
The water within the SFP and surrounding pools will be more highly borated than standard fuel pools. Corrosion of the mild steel reinforcing bar inside concrete walls and slabs is therefore of concern. Although actions A2 and A3 are aimed at detecting leakage through the secondary barriers comprising RC construction, the effect on the structural integrity must also be evaluated.
8. The scope of assessment is appropriate for GDA because it focusses on minor leakage from the pools in the fuel handling area that may be undetected for a period of time. This type of leak has the potential to damage the internal structure of the CA structural modules, but also to eventually migrate to the external environment. The main concern is that these potential leakage paths could be undetected for a long period of time (chronic leaks), and that the extent of the resulting damage/contamination, if finally detected, would not be quantifiable.
9. This assessment report is one of three civil engineering reports produced to close out AP1000 design issues before the award of a DAC. The two other related reports present ONR assessment of Westinghouse’s response to the following GDA issues: GI-AP1000-CE-01, GI-AP1000-CE-02 and GI-AP1000-CE-03.
10. This assessment complies with internal guidance on the mechanics of assessment within ONR(Ref. 4)
11. It was not practicable or necessary to assess all components of the work scope to the same degree. I decided to use a combination of two different assessment methods: i) broad review and ii) deep-dive assessment. I used a broad review to provide an overview of a submission or a significant part of a submission. I undertook a deep-dive assessment (if required) on one (or more if appropriate) element of a submission to examine the detail from the response, through the detail design development to the final output for construction.
Office for Nuclear Regulation Page 8 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
12. ONR’s GDA Guidance to Requesting Parties (RPs) (http://www.onr.org.uk/new- reactors/ngn03.pdf) states that the information required for GDA may be in the form of a PCSR, and Technical Assessment Guide (TAG) 051 sets out regulatory expectations for a PCSR (http://www.onr.org.uk/operational/tech_asst_guides/ns-tast-gd-051.pdf).
13. At the end of Step 4, ONR and the Environment Agency raised GDA Issue GI-AP1000- CC-02 (http://www.onr.org.uk/new-reactors/reports/step-four/westinghouse-gda- issues/gi-ap1000-cc-02.pdf) requiring that Westinghouse submit a consolidated PCSR and associated references to provide the claims, arguments and evidence to substantiate the adequacy of the AP1000 design reference point.
14. A separate regulatory assessment report is provided to consider the adequacy of the PCSR and closure of GDA Issue GI-AP1000-CC-02, and therefore this report does not discuss the CE aspects of the PCSR. This assessment focused on the supporting documents and evidence specific to GDA Issue GI-AP1000-CE-04.
15. The standards and criteria adopted within this assessment are principally the Safety Assessment Principles (SAPs) (Ref. 5), internal TAGs (Ref. 6), relevant national and international standards and RGP informed from existing practices adopted on UK nuclear licensed sites.
16. The key SAPs applied within the assessment are included within Table 2.
Table 2: Key SAPs used within assessment
Guidance Title
ONR Safety Assessment Civil Engineering SAPs within the engineering principles: Principles ECE.1 Engineering principles: civil engineering. Functional performance ECE.2 Engineering principles: civil engineering. Independent arguments ECE.3 Engineering principles: civil engineering. Defects ECE.7 Engineering principles: civil engineering: design. Foundations ECE.8 Engineering principles: civil engineering: design. Inspectability ECE.12 Engineering principles: civil engineering: design. Structural analysis and model testing ECE.13 Engineering principles: civil engineering: structural analysis and model testing. Use of data ECE.14 Engineering principles: civil engineering: structural analysis and model testing. Sensitivity studies ECE.16 Engineering principles: civil engineering: construction. Materials ECE.17 Engineering principles: civil engineering: construction. Prevention of defects ECE.18 Engineering principles: civil engineering: construction. Inspection during construction
Office for Nuclear Regulation Page 9 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
ECE.20 Engineering principles: civil engineering: in-service inspection and testing. Inspection, testing and monitoring ECE.22 Engineering principles: civil engineering: in-service inspection and testing. Leak tightness
Other SAPs from the engineering principles: EKP.2 Engineering principles: key principles. Fault tolerance EKP.3 Engineering principles: key principles. Defence in depth EKP.4 Engineering principles: key principles. Safety function EKP.5 Engineering principles: key principles. Safety measures EAD.1 Engineering principles: ageing and degradation. Safe working life EAD.2 Engineering principles: ageing and degradation. Lifetime margins EHA.4 Engineering principles: external and internal hazards. Frequency of initiating event EHA.5 Engineering principles: external and internal hazards. Design basis event operating states EHA.7 Engineering principles: external and internal hazards. ‘Cliff-edge’ effects EHA.18 Engineering principles: external and internal hazards. Beyond design basis events
17. The TAGs that have been used as part of this assessment are set out in Table 3.
Table 3: TAGs used within assessment
Guidance Title
ONR Technical Assessment NS-TAST-GD-005 Guidance on the Demonstration of Guides ALARP Revision 7
NS-TAST-GD-017 Civil Engineering Revision 3
Office for Nuclear Regulation Page 10 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
18. The international standards and guidance that have been used as part of this assessment are set out in Table 4.
Table 4: Standards and guidance used within assessment
Guidance Title
Relevant Codes American Society of Mechanical Engineers - International Boiler and Pressure Vessel Code. Section III. Rules for Construction of Nuclear Facility Components American Society of Civil Engineers 7-05: ASCE Standard for Minimum Design Loads for Buildings and Other Structures BS 4449:2005 Specification for carbon steel bars for the reinforcement of concrete American Concrete Institute ACI 349-M06: Code Requirements for Nuclear Safety-Related Concrete Structures and Commentary American Concrete Institute ACI 350.3-06: Seismic Design of Liquid-Containing Concrete Structures ANSI/AISC N690-12: Specification for Safety-Related Steel Structures for Nuclear Facilities American Bureau of Shipping, Rules for Building and Classing: Floating Production Installations 2014, ABS, July 2014.
19. It is usual in GDA for ONR to use technical support, for example to provide additional capacity to optimise the assessment process, enable access to independent advice and experience, analysis techniques and models, and to enable ONR’s inspectors to focus on regulatory decision-making etc.
20. I used technical support across all areas of this assessment scope to provide resource and expertise not available within ONR.
21. Whilst the TSCs undertook detailed technical reviews, ONR supervised this work and made the regulatory judgement on the adequacy of the CE arguments for the AP1000.
22. As part of this assessment, I did not consider any cross-cutting issues.
23. The ONR issues and Westinghouse resolution plans clearly defined the scope of the assessment. Items that have been agreed with Westinghouse as being outside the scope of this assessment report are:
Post-Fukushima considerations
Malicious Aircraft Impact Assessment
Office for Nuclear Regulation Page 11 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
Assessment Findings and site specific aspects relating to the GDA resolution plans and their close-out
Office for Nuclear Regulation Page 12 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
24. The Westinghouse safety case for resolution of GDA Issue GI-AP1000-CE-04: Fuel Handling Area, Secondary Containment Leak Detection and Collection System (Ref. 1) is documented in Westinghouse’s Resolution Plan GI-AP1000-CE-04: Fuel Handling Area, Secondary Containment Leak Detection and Collection System (Ref. 3).
25. The Westinghouse resolution plan is structured against the GDA issue, where the scope of the GDA issue is further described by reference to a number of actions.
26. The resolution plan (Ref. 3) provides an overview of the SFP and CA20 structural module make-up. The description includes information regarding the primary and secondary leak barriers and the systems in place for leakage detection. TQ-AP1000- 1218 (Ref. Error! Reference source not found.) and TQ-AP1000-1270 (Ref. 9) provide additional information on welds in the SFP. The Technical Queries (TQs) responses provide a description of welds and system of leak chases to prevent borated water from getting behind the various pool liner plates.
27. Westinghouse has undertaken an ALARP assessment to evaluate whether any additional leakage detection in the area below the SFP would be ALARP. In addition, Westinghouse has performed a review of the fuel handling area and evaluated condensate collection points.
28. To perform the ALARP assessment, Westinghouse has evaluated both the existing design and alternative options. Options have been investigated, including examining the benefits of adding a series of weep holes in the walls and ceiling of the waste holdup tank rooms below to provide an additional means of detection to prevent any potential leakage from causing significant damage to the structure elements behind the module plates or from reaching the environment.
29. An overview of the west RC wall and CA20 structural module make-up is provided in the resolution plan (Ref. 3). The description includes information regarding the primary and secondary leak barriers and the systems in place for leakage detection
30. Westinghouse has undertaken an ALARP assessment that evaluates the existing design and potential design alternatives. An optioneering exercise to evaluate the addition of weep holes in the plate in the west RC wall and ceiling below the fuel transfer canal has been demonstrated.
31. The resolution plan (Ref. 3) details the requirement that the future licensee is expected to establish a groundwater monitoring programme.
32. An overview of the SFP north wall and CA20 structural module make-up is provided in the resolution plan (Ref. 3). The description includes information regarding the primary and secondary leak barriers and the leakage propagation mechanisms.
Office for Nuclear Regulation Page 13 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
33. Westinghouse has undertaken an ALARP assessment to evaluate the current design and potential design alternatives. An optioneering exercise to evaluate the addition of weep holes in the plate in the SFP north wall and ceiling below the fuel transfer canal has been demonstrated.
34. Westinghouse has undertaken an ALARP evaluation to review the AP1000 SFP leak chase design. The ALARP evaluation demonstrates that adequate means of leakage prevention and detection are available for the AP1000 SFP.
35. The response to this action provides an analysis to demonstrate the corrosion rate of the carbon steel if it were exposed to water from the SFP.
36. Westinghouse has produced calculations to demonstrate that the capacity of the shear studs in the duplex plate exceeds the required structural capacity and that minor leakage through the SFP liner will not cause a structural failure of the SFP.
37. In support of Resolution Plan GI-AP1000-CE-04: Fuel Handling Area, Secondary Containment Leak Detection and Collection System (Ref. 3), Westinghouse provided the following documents:
UKP-GW-GL-799 AP1000® Plant ALARP Assessment of Structural Impact from Fuel Handling Area Pools Leakage, Revision 0 (Ref. Error! Reference source not found.)
Westinghouse Response to Technical Query TQ-AP1000-1218 (Ref. 8)
Westinghouse Response to Technical Query TQ-AP1000-1270 (Ref. 9)
38. Following an initial review of the ALARP Assessment by ONR and ONR TSC, Westinghouse amended the ALARP assessment and provided additional documents:
UKP-GW-GL-790 UK AP1000 Environmental Report, Revision 5A (Ref. 10) and Rev 6 (Ref. 23)
Westinghouse Electric Company, ALARP Assessment of Secondary Containment Leakage (1 of 2), Response to RQ-AP1000-1569 (Ref. 11)
Westinghouse Electric Company, ALARP Assessment of Secondary Containment Leakage (2 of 2), Response to RQ-AP1000-1574 (Ref. 12)
UKP-GW-GL-799 AP1000® Plant ALARP Assessment of Structural Impact from Fuel Handling Area Pools Leakage, Revision 1 (Ref. 13) and Revision 2 (Ref. 22)
LTR-CCOE-15-35 Evaluation of Impact of Boric Acid Leakage on AP1000 Plant Spent Fuel Pool Reinforced Concrete Corrosion and Degradation (Ref. 14)
Westinghouse Electric Company, Further Clarifications Required for the Response to CE-04, Response to RQ-AP1000-1686 (Ref. 15)
Office for Nuclear Regulation Page 14 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
DCP_JNE_000496 Response to Action Items from GDA Civil Engineering Meeting (Ref. 16)
Office for Nuclear Regulation Page 15 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
39. This assessment has been carried out in accordance with HOW2 guide NS-PER-GD- 014, “Purpose and Scope of Permissioning” (Ref. 17).
40. The scope of this assessment was limited to the scope of GDA Issue GI-AP1000-CE- 04 Revision 0, as presented in the resolution plan (Ref. 3). I assessed only the actions listed for the GDA issue and did not consider any other issues.
41. Westinghouse’s submissions to justify that it meets ONR’s expectations and that risks are reduced So Far As Is Reasonably (SFAIRP) have been limited to those listed in Section 3.5. These submissions have formed the basis of my assessment.
42. ONR assessment of Westinghouse’s submissions is supported by the technical assessment work undertaken by the ONR TSC. The technical review of Westinghouse’s submissions undertaken by the ONR TSC is recorded in the submission to ONR (Ref 18).
43. The assessment was furthered through a series of level 4 technical engagements that I held with Westinghouse, supported by the ONR TSC when necessary. These engagements were supplemented by technical workshops and the ONR Regulatory Query (RQ) process.
44. Sections 4.2 to 4.5 describe my assessment and judgement of Westinghouse’s submission and a sample of evidential documents. The assessment is broken down into the four actions as listed in the GDA issue resolution plan (Ref. 3).
45. Each of the sections describes the CE regulatory action that ONR placed on Westinghouse to resolve the specific aspect of the GDA issue and describes my key assessment considerations and judgment, which includes:
my CE judgement on the adequacy of Westinghouse’s response to close the expectation related to the GDA issue; and
the details of any minor shortfalls and Assessment Findings resulting from my engagement (if applicable).
46. GDA Issue Action GI-AP1000-CE-04.A1 in the resolution plan (Ref. 3) is as follows:
47. “Secondary Containment Leak Detection and Collection System for Module CA20 SC Walls and HSC Floors.
Provide a leak detection/collection system to the secondary barrier formed by the CA steel-concrete composite construction which will:
Allow potential leaks into the structure to be detected and monitored. [Action Item 1]
Collect the potential leakage and divert it away from the significant mild steel components of the CA module. [Action Item 2]
Office for Nuclear Regulation Page 16 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
Protect against migration of potential leaks into the base slab below. [Action Item 3]
With agreement from the Regulator this action may be completed by alternative means.”
48. Westinghouse’s response to TQ-AP1000-1218 (Ref. 8) describes the claims on leak detection and monitoring:
49. “An operator can detect leakage from the spent fuel pool by two diverse means. The spent fuel pool has three UK Class 1 level detectors that would alarm the operator if the normal pool level began to drop. The leak chase system is also equipped with level detectors in its collection pots which provide an alarm to alert the operator that the pot contains liquid.”
50. I consider the provision of the Class 1 level leak detection system, as described above, to be an adequate response in principle to Action Item 1, provided that the design and manufacture of the detection systems are adequate.
51. I note that high standards of housekeeping are required to maintain and make these systems work over the entire operational life of the facility. Provision should be made for how the instruments are maintained and tested / replaced in the event of failure and the leak detection system should be able to quickly identify the location in the event of a leak, eg by having leak systems / channels independent for each wall.
52. I judge that the Westinghouse response to Resolution Plan GI-AP1000-CE-04.A1, Action Item 1 satisfies SAPs (Ref. 5) ECE.2, ECE.20, EKP.2, and EKP.3 as it has demonstrated that potential leaks into the structure would be detected and monitored.
53. Westinghouse’s response to TQ-AP1000-1218 (Ref. 8) and TQ-AP1000-1270 (Ref. 9) describes the claims on leak tight boundaries:
54. “For leakage to get between the wall plate and concrete, two leak tight boundaries would have to fail. The primary boundary, the wall plate seam weld, would first have fail allowing water to pass into a leak chase channel directly behind the weld seam. This leak chase channel is continuously welded to the back side of the wall plate forming a secondary leak tight boundary.”
55. In the CA20 design concept, Westinghouse defines the two barriers to leakage to be (i) the SFP liner and (ii) the leak chases. So the liner plates form the SFP and they are seam welded in the vertical axis; the leak chases are located on the dry side of the liner and also welded in the vertical axis, forming the secondary barrier of leakage into the structural concrete. Leak chases are also provided to the floor liner, although it is noted that they are not welded to the liner (Section 3.2.1.3 of Ref. 13). This is discussed in Action Item 3, which focuses on the base slab.
56. In addition, regarding two leak barriers for the pools that are filled with borated water, both the plate liner and the leak chases provided along each weld in these pools are to be made with corrosion-resistant Duplex 2101 stainless steel or equivalent, as stated in TQ-AP1000-1218 (Ref. 8):
57. “Duplex plate is used on the surface of the modules in contact with borated water. These walls are designed as class 1 structures. The weld locations in these plates are fitted with leak chases. The leak chases are also fabricated from Duplex plate of equivalent material.”
Office for Nuclear Regulation Page 17 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
58. TQ-AP1000-1218 (Ref. 8) confirms that the Module CA20 SC walls will be included in the leak chase subsystem:
59. “The leak chase subsystems are part of the Liquid Radwaste System (WLS) and the Radioactive Waste Drain System (WRS).”… “The leak chases for the pools outside containment are part of the WRS. These leak chases would capture potential leakage from the fuel transfer canal, spent fuel pool, cask loading pit, and the cask washdown pit.”
60. I judge that the Westinghouse response to Resolution Plan GI-AP1000-CE-04.A1, Action Item 2, with regards to the provision of a leak chase collection subsystem to protect against potential leakage, as described above, has been adequately demonstrated as a response to Action Item 2. Westinghouse has satisfied SAPs (Ref. 5) ECE.3, ECE.16, ECE.17, EKP.2, EKP.3 and EKP.5.
61. Westinghouse states in Section 3.2.1 of Ref. 13 that the leak chase subsystem protects against migration of potential leaks from the SFP, which has an HSC floor. The Module CA20 HSC floor of the pool will be included in the leak chase subsystem, as stated in TQ-AP1000-1270 (Ref. 9):
62. “The spent fuel pool floor liner is installed once the module is set in place. The liner is welded to wall plate by a full penetration weld. Figures 2-4 provide the typical detail for these leak chases.”
63. The figures provided in TQ-AP1000-1270 (Ref. 9) indicate the provision for secondary barrier leak chases in the floor plate liner. I note that the leak chases are not welded to the liner (Section 3.2.1.3 of Ref. 13). There is a risk of leakage at this location: if there is a slope in the floor plate, any water that has breached the primary barrier can run along the underside of the plate and over the top of the leak chase. This could be made worse by any imperfections in the floor plate or leak chase. Westinghouse has not demonstrated that it has considered a means of reducing the risk of leakage at this location by incorporating a gasket of a radiation-resistant compound between the floor plate and leak chase to provide a water seal. This would need to be proven for the full design life of the SFP.
Assessment Finding CP-AF-AP1000-CE-03:
The licensee shall demonstrate that the design satisfies the two barrier principle at joints between the floor liner plates in the half steel-concrete composite floors.
64. I judge that the provision of a leak chase collection subsystem in the Module CA20 HSC floor of the pool, consisting of a secondary barrier leak chase in the floor plate liner, to protect against potential leakage into the base slab has been adequately demonstrated as a response to Resolution Plan GI-AP1000-CE-04.A1, Action Item 3. Westinghouse has satisfied SAPs (Ref. 5) ECE.3, ECE.16, ECE.17, EKP.2, EKP.3 and EKP.5.
65. GDA Issue Action GI-AP1000-CE-04.A2 in the resolution plan (Ref. 3) is as follows:
Office for Nuclear Regulation Page 18 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
“Secondary Containment Leak Detection And Collection System for West RC wall to Transfer Canal.
Provide a leak detection/collection system to the secondary barrier formed by the RC wall which is cast up against the single plate stainless steel liner to the west wall of module CA20. This should include:
Method to detect leakage through the RC wall, both above and below ground. [Action Item 1]
Collect the potential leakage, and thus protect against migration of potential leaks into the ground. [Action Item 2]
With agreement from the Regulator this action may be completed by alternative means.”
66. ONR made the following comment in RQ-AP1000-1686 (Ref. 15):
67. “Although not described and made clear in the ALARP Assessment, as part of the resolution plan were included two TQs (1218 and 1270), both of which make a general claim that structural examinations of the CA20 structure will be conducted by using UT and “other advanced NDE methods”. In addition, it was stated that “NDE techniques which could be used to evaluate potential defects in the concrete or reinforcement behind the liner plates…” However, evidence that the proposed NDE methods identified can be feasibly, reliably and practically applied for the CA20 module, while taking account of the likely conservative corrosion mechanism(s), and particular attention to regions of high utilisation DCR and the actual practicality over 60 years, further accounting for 75+ > 100 years use, needs to be adequately substantiated and demonstrated as realistic.
Of specific importance will be both the North Wall and the West Wall regions, also remembering that the ALARP Assessment report has openly stated that “concern is where leakage can travel through the wall and to the outer surface of Wall N” (Section 4.4.4.2).”
68. Westinghouse’s response to the comment in RQ-AP1000-1686 (Ref. 15) regarding structural examinations states that in the “unlikely event of leakage” the leakage would become visible, for both the connection of the CA module to the basemat:
69. “At this elevation leakage will seep below the bottom of the liner plate and will become visible on the surface of the basemat at elevation 66’-6”.
70. and for the west wall (Wall N) and the north wall (Wall 4):
71. “leakage can also flow through the wall and would eventually pass through the concrete and become visible on the opposite surface of the wall.”
72. Therefore, Westinghouse expects that the “site licensee’s programme will have walkthroughs and overall visual examinations performed of the structures throughout the life of the plant” (Ref. 15). This would include visual inspections of all of the CA module connections, Wall N and Wall 4. Following the visual inspections, Westinghouse stated (Ref. 15) that:
73. “If there are any contrary indications from the above inspections, detailed investigations will be required. These could include non-destructive as well as invasive inspections.”
Office for Nuclear Regulation Page 19 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
74. However, an investigation into the reliability of Non-Destructive Examination (NDE) techniques performed by Westinghouse indicated that current techniques are inadequate, as stated in Ref. 15:
75. “This investigation of techniques for the shield building did not show these advanced techniques to be currently effective for detecting voids. However, the techniques are constantly being improved and may be available for future corrosion investigations of the spent fuel pool.”
76. The Westinghouse response questions the use of current techniques for providing NDE inspections and relies on further development in the future to satisfy the claim made in TQ-AP1000-1218 (Ref. 8) regarding the use of “other advanced NDE methods”.
77. Westinghouse’s reliance on NDE methods requires justification that risks from the design and supporting corrosion calculations are ALARP for the full lifecycle of the facility. These risks need to consider the possibility that NDE techniques are unfeasible in the future. Also, in the event of a leak, a contingency plan should be in place in the case of having to repair the liner that is both practicable and justified to the reference design configuration.
78. With regard to the corrosion rates used by Westinghouse in response to GI-AP1000- CE-04, I do not consider them to be conservative. However, Resolution Plan Action GI-AP1000-CE-04.A4 (Ref. 3) requires a “best estimate” evaluation, which I judge that Westinghouse has provided. This is discussed in GI-AP1000-CE-04, which focuses on understanding that the effects on the structural integrity following potential leakages.
79. Regarding the high Design to Capacity Ratios (DCRs), Westinghouse responded in (Ref. 15) that it has calculated them conservatively considering that:
80. “These DCRs are based on structural design criteria and analyses that assume conservatively that the maximum response to the SSE and the maximum accident thermal response occur concurrently”… “Since the maximum accident thermal response occurs many hours after the initiation of the accident, these are two independent events and do not need to be combined.”
81. I agree that this is an onerous condition and that these events would be unlikely to occur simultaneously, therefore I consider the response from Westinghouse to Action Item 1 regarding DCRs to be adequate. However, if no NDE techniques are feasible then I require justification that risks from the design and supporting corrosion calculations are ALARP for the full lifecycle of the facility. In the event of a leak, a contingency plan should be in place in the case of having to repair the liner that is both practicable and justified to the reference design configuration.
82. Given the above assessment, I judge that ONR SAPS ECE.2, ECE.20, ECE.22 and EKP.3 have not been fully addressed.
Assessment Finding CP-AF-AP1000-CE-04:
The licensee shall provide a conservative analysis of the corrosion rate used to assess the effects of highly borated water on steel reinforcement in the SFP. If this analysis shows insufficient resilience in the structure the licensee shall investigate and develop options for testing and repair.
Office for Nuclear Regulation Page 20 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
83. The Westinghouse ALARP assessment (Ref. 13) makes several claims based on requirements from future licensees to ensure that the secondary containment and leak collection system meet RGP. I require that these claims are fulfilled by the licensee to ensure that the Westinghouse ALARP report remains valid.
Assessment Finding CP-AF-AP1000-CE-05:
The licensee shall establish a site-specific groundwater monitoring programme and model that includes information from the Westinghouse ALARP Assessment and Westinghouse Environmental Report for the full life cycle of the facility.
84. As noted previously, Westinghouse defines two barriers to leakage in the CA20 to be (i) the SFP liner and (ii) the leak chases. In addition, regarding the two leak barriers for the pools that are filled with borated water, both the plate liner and the leak chases provided along each weld in these pools are to be made with corrosion-resistant Duplex 2101 stainless steel, as stated in TQ-AP1000-1218 (Ref. 8).
85. TQ-AP1000-1218 (Ref. 8) confirms that the SFP Module CA20 walls, including the fuel transfer canal, will be included in the leak chase subsystem:
86. “The leak chase subsystems are part of the Liquid Radwaste System (WLS) and the Radioactive Waste Drain System (WRS).”… “The leak chases for the pools outside containment are part of the WRS. These leak chases would capture potential leakage from the fuel transfer canal, spent fuel pool, cask loading pit, and the cask washdown pit.”
87. The provision of a leak chase collection subsystem to protect against potential leakage into the base slab has been adequately demonstrated as a response to GI-AP1000- CE-04.A2, Action Item 2. However, the ALARP assessment (Ref. 13) also considers cases where a leak has occurred through both the primary plate liner and the secondary leak chase, and has entered the gap between the concrete and steel liner; and Section 4.4.2.3 states that:
88. “If a leak were to travel down the gap between the liner and the concrete, leakage degradation can be subjected to the basemat concrete. The interface between the fuel transfer canal west wall (Wall N) and the basemat is discussed in more detail within Section 2.2.2.2.”
89. I note from the reference in the statement above that despite the title of Section 2.2.2.2 (in Ref. 13), the connection described in the section is that of a module SC wall to basemat and there is no mention of the connection of an RC wall to basemat. A description of the RC wall to basemat connection could have provided additional detail for review in terms of the effect of leakage.
90. The above statement (from Section 4.4.2.3, Ref. 13) continues with a description of the distance between the RC wall and the lowest pit floor:
91. “This connection is at the bottom of the reinforced concrete wall and is at least 6.1m (20ft) below the lowest pit floor. Since the leakage will have to travel down the entire wall surface of at least 6.1m (20ft), it is expected that the leakage will have contact with concrete before the leakage pools along the basemat at the bottom of the wall.”
92. Combine the above statement with Westinghouse’s response to RQ-AP1000-1686 (Ref. 15) regarding compression in the concrete in the wall, which states that:
Office for Nuclear Regulation Page 21 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
93. “The concrete close to the inside face is in compression under accident thermal condition which acts to close any cracks and minimise any leakage flow.”
94. and, that the plates at the bottom of the RC wall are not in contact with the accident thermal conditions (Section 4.4.2.3, Ref. 13):
95. “It is also noted that this plate is not connected to the boiling of the pool, and will thus not see the accident thermal conditions which causes the larger corrosion rate.”
96. This suggests that the corrosion rate at the basemat connection would be relatively low. This conclusion is based on the assumption that the pH level of the boric acid is sufficiently raised by coming into contact with a reasonable quantity of concrete, and has no additional corrosion due to thermal effects. This is described in the supporting letter concerning the “Evaluation of Impact of Boric Acid Leakage on AP1000 Plant Spent Fuel Pool Reinforced Concrete Corrosion and Degradation” (Ref. 14).
97. Therefore, the amount of corrosion expected for a 100-year leak is relatively small at 1 mm, (as presented in Section 4.4.2.3, Ref. 13):
98. “In this case the corrosion rate of 0.06cm (0.02 in) over a 60 year life of plant leak and 0.1cm (0.04 in) for a 100 year leak is applicable in this area for carbon steel. If an accident condition were to occur, the amount of additional leakage will cause an additional 10μm of corrosion on the carbon steel assuming an additional one year of corrosion for the accident thermal condition occurrence.”
99. The following statement is made by Westinghouse in Section 4.4.2.3 (of Ref. 13) that the corrosion calculation is conservative:
100. “This makes this evaluation conservative. As shown above, this is not enough corrosion to cause failure of the structure. However, evaluation of the basemat concrete is needed.”
101. Westinghouse has justified a low amount of additional corrosion under the accident condition based on the distance of the RC wall to basemat connection to the lowest pit floor (6.1 m) and that the plates at the connection remain unaffected by an event that results in adverse thermal conditions. The corrosion rate used in this justification is considered in GI-AP1000-CE-04.A4 and I conclude that the assumptions made for both of these points are considered to be not conservative.
102. Corrosion allowance information for this application with concrete in combination with steel is difficult to acquire, and there are different approaches that can be taken to account for uncertainty and making conservative estimates.
103. I have sought RGP regarding the design of pressure vessels to American Society of Mechanical Engineers (ASME) Section VIII (Division 1) (Ref. 19). Generally, the owner / operator identify the need for a given safety factor in terms of corrosion allowance, implying a greater corrosion allowance than the standard minimum. The corrosion allowance for pressure vessels is stipulated by the owner / operator because it has significant hands-on experience of the behaviour of its process plant, and can therefore balance availability, safety and capital cost. Situations exist where owner / operators had to initiate extensive and expensive weld repairs. However, repairs are not generally easy in the case of an SFP, particularly when examinations or inspections are unable to identify the vulnerable and potentially weak locations inside the solid RC structure.
104. For the design life of Floating Production Installations (Ref. 20), published by the American Bureau of Shipping (ABS), for which corrosion and fatigue are important design issues, it is considered “where the structural design life is greater than 20 years
Office for Nuclear Regulation Page 22 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
and the floating installation is designed for uninterrupted operation on-site without any dry docking, the nominal design corrosion values (NDCV) of the hull structure are to be increased”. Hence, the corrosion rate is based on a conceptual design life of only 20 years.
105. I accept that the approaches described above are somewhat different from the SFP reinforcement being used here.
106. I judge that the provision of two corrosion-resistant Duplex 2101 stainless steel leak barriers as part of a leak chase collection subsystem to protect against potential leakage into the base slab has adequately addressed the issue raised under GI- AP1000-CE-04.A2, Action Item 2. Westinghouse has demonstrated defence in depth satisfied and satisfied the requirements of SAPs (Ref. 5) ECE.3, ECE.16, ECE.17, EKP.2 and EKP.3.
107. GDA Issue Action GI-AP1000-CE-04.A3 in the resolution plan (Ref. 3) is as follows:
108. “Secondary containment leak detection and collection system for north wall of spent fuel pool.
Provide a leak detection/collection system to the secondary barrier formed by the RC wall which is cast between the north single plate stainless steel liner of the spent fuel pool and the shield building. This should include:
Method to detect leakage through/into the wall. [Action Item 1]
Collect the potential leakage, and thus protect against migration of potential leaks into the ground. [Action Item 2]
With agreement from the Regulator this action may be completed by alternative means.”
109. Westinghouse’s answer to TQs regarding leak detection, TQ-AP1000-1218 (Ref. 8), states that:
110. “An operator can detect leakage from the spent fuel pool by two diverse means. The spent fuel pool has three UK Class 1 level detectors that would alarm the operator if the normal pool level began to drop. The leak chase system is also equipped with level detectors in its collection pots which provide an alarm to alert the operator that the pot contains liquid.”
111. I consider the provision of the Class 1 level leak detection system, as described above, to be an adequate response in principle to Action Item 1. This is provided that the design and manufacture of the detection systems are adequate.
112. I note that high standards of housekeeping are required to maintain and make these systems work over the entire operational life of the facility. Provision should be made for how the instruments are maintained and tested / replaced in the event of failure. And the leak detection system should be able to quickly identify the location in the event of a leak, eg by having leak systems / channels independent for each wall.
Office for Nuclear Regulation Page 23 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
113. I judge that the Westinghouse response to Resolution Plan GI-AP1000-CE-04.A3, Action Item 1 satisfies (Ref. 5) ECE.2, ECE.20, EKP.2, and EKP.3 as it has demonstrated that potential leaks into the structure would be detected and monitored.
114. As noted previously, for the CA20 design concept Westinghouse defines the two barriers to leakage to be (i) the SFP liner and (ii) the leak chases. In addition, regarding the two leak barriers for the pools that are filled with borated water, both the plate liner and the leak chases provided along each weld in these pools are to be made with corrosion-resistant Duplex 2101 stainless steel, as stated in TQ-AP1000- 1218 (Ref. 8).
115. TQ-AP1000-1218 (Ref. 8) confirms that the Module CA20 walls will be included in the leak chase subsystem:
116. “The leak chase subsystems are part of the Liquid Radwaste System (WLS) and the Radioactive Waste Drain System (WRS).”… “The leak chases for the pools outside containment are part of the WRS. These leak chases would capture potential leakage from the fuel transfer canal, spent fuel pool, cask loading pit, and the cask washdown pit.”
117. I judge that the Westinghouse response to Resolution Plan GI-AP1000-CE-04.A3, Action Item 2, with regards to the provision of a leak chase collection subsystem to protect against potential leakage as described above, has been adequately demonstrated as a response to Action Item 2. Westinghouse has satisfied SAPs (Ref. 5) ECE.3, ECE.16, ECE.17, EKP.2, EKP.3 and EKP.5.
118. GDA Issue Action GI-AP1000-CE-04.A4 in the resolution plan (Ref. 3) is as follows:
119. “Evaluate the effect of borated water from potential leakage from spent fuel pool on mild steel components within CA20.
The water within the spent fuel pool and surrounding pools will be more highly borated than standard fuel pools. Corrosion of the mild steel reinforcing bar inside concrete walls and slabs is therefore of concern. Although actions A2 and A3 are aimed at detecting leakage through the secondary barriers comprising RC construction, the effect on the structural integrity must also be evaluated. Westinghouse should provide the following:
A best estimate evaluation on the potential corrosion rates of mild steel reinforcing bars within the RC construction to the spent fuel pools and adjacent pools when subject to minor, chronic leaks from the pools. [Action Item 1]
An evaluation of the effects on the structural capacity of the same RC walls / slabs from the above effects on the rebar. [Action Item 2]
With agreement from the Regulator this action may be completed by alternative means.”
120. Section 4.1.2 of the ALARP assessment (Ref. 13) describes the mechanism by which the pH level of the leaked borated water is increased by coming into contact with concrete, stating that:
Office for Nuclear Regulation Page 24 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
121. “Any boric acid that diffuses into the Spent Fuel Pool (SFP) concrete will come in contact with the structural and reinforcing steel. Borated water that leaks through the SFP liner initially will be acidic, so cracks or gaps in the concrete could put steel in direct contact with low pH water. However, as it diffuses into the concrete pores or flows through the concrete joints or cracks, it will react chemically with the cement matrix and possibly also with the concrete aggregate, and the solution pH will increase. In general, the steel corrosion rate increases with boric acid concentration and temperature, with very low rates for boric acid neutralized with cement.”
122. Section 4.1.2 of the ALARP assessment (Ref. 13) then describes how the corrosion rate would drop from 430 μm/year to approximately 10 μm/year as a result of coming into contact with the concrete, stating that:
123. “Extrapolating corrosion rate data for steel in various boric acid solutions over a range of temperatures, a corrosion rate of 430μm/year would be expected for the AP1000 plant SFP conditions. This corrosion rate would apply if there are cracks or gaps in the concrete, such that the structural steel would come into direct contact with spent fuel pool water. However, as boric acid solution diffuses into the matrix of concrete, the pH would be neutralised by the presence of the concrete, and the steel corrosion rate would be expected to be considerably lower, approximately 10μm/year.”
124. In addition, the supporting letter “Evaluation of Impact of Boric Acid Leakage on AP1000 Plant Spent Fuel Pool Reinforced Concrete Corrosion and Degradation” (Ref. 14) provided by Westinghouse has been reviewed as part of the assessment of the Westinghouse response to Action Item 1 of the Resolution Plan GI-AP1000-CE- 04.A4 (Ref. 3). Figure 8 (of Ref. 14) indicates that there is a dramatic ‘cliff-edge’ increase in corrosion rate when the pH level drops below 6.8. The pH level at which this change in corrosion rate happens is described in the text as: “The threshold pH for carbon steel corrosion in borated solution was therefore judged to be between 6.8 and 7.3” (Section 3.2, p12, Ref. 14). The use of a corrosion rate of 10 μm/year, reduced from a rate of 430 μm/year, is therefore dependent on the pH level of the boric acid being above 6.8 across all of the CA20 design where there is the potential for leakage. The mechanism by which the pH level is increased is described as “leaching by boric acid solution diffusing into concrete is mitigated by the acid-neutralizing capacity of the cement minerals”, thus the reduced corrosion rate is maintained as “the pH would remain above the threshold for carbon steel corrosion” (Section 3.2, p13, Ref. 14). The estimated corrosion rate of 1 μm/year from Figure 8 (of Ref. 14) was then adjusted to 10 μm/year to account for the higher temperature of the AP1000 plant SPF.
125. I judge the Westinghouse analysis to satisfy the requirements of a “best estimate” evaluation as required in Resolution Plan GI-AP1000-CE-04.A4 (Ref. 3), Action Item 1. However, I consider that a conservative estimate of corrosion rate should be used for a design situation relating to sustaining integrity during the SFP operational life. Based on Figure 8 (Ref. 14), it would be reasonable to apply a conservative corrosion rate for the RC design calculations to account for variations in the pH, or to perform a sensitivity assessment on the corrosion rate to ascertain if there may be a possible problem of structural integrity in later life. A conservative corrosion rate should be considered for the design life period of 60 years and the service life that extends to 100 years. I discuss the lack of feasible NDE techniques in the assessment of GI-AP1000- CE-04.A2, Action 1. Limitations on NDE methods to assess the structure may introduce poor awareness of the SFP condition and limit confidence in the longer-term integrity. The Westinghouse response assumes a low corrosion rate without consideration of the potential ‘cliff-edge’ increase at some point between, say, 40 and 75 years.
126. An example of RGP in the design of SFPs can be taken from the paper on the THORP Receipt & Storage: design and construction (Ref. 21). The paper describes the essential features of the receipt and storage facility that forms part of the Thermal
Office for Nuclear Regulation Page 25 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
Oxide Reprocessing Plant (THORP) nuclear reprocessing plant at Sellafield. The following points taken from the paper are considered as RGP in the design of SFPs:
The structural design was comprehensive with cases for normal operation, dropped load and external hazards all modelled, empirically proven and tested in advance of the main construction. The operational case also considered leakage of the pond and was well designed with redundancy.
A decision was made early in the project to provide an enclosed pond, and further, that sunlight was completely blocked from entering the facility to mitigate any algae growth.
The water-retaining was achieved with careful detailing and construction techniques and implemented under rigorous construction criteria.
Measures were taken to ensure leakage could be repaired from the outside surfaces without emptying the pond. Therefore, the pond is maintained within its design envelope throughout its operational life.
127. The approach to design should be to determine the fault conditions and operational challenges before designing and, as in the case of THORP, design them out and remain within the operating envelope. There should be a means to respond effectively to leakage while remaining in operation, and minimise that probability through effective design and construction. And the assumptions made when checking the design “should be selected or applied so that the analysis is demonstrably conservative”, as dictated by ONR SAP ECE.13.
128. There is also the potential for increased flow rates, particularly in accident conditions, which could be greater than the mechanism by which the cement matrix can neutralise the pH of the borated water.
129. The general approach for nuclear safety-related engineering assessments requires demonstrably conservative criteria (eg corrosion rates) to be used as specified in ONR SAPs ECE.13 and EHA.5 during the operational life of the facility. Figure 8 in the response from Westinghouse concerning corrosion rates (Ref. 14) suggests that there would be a significant ‘cliff-edge’ increase in corrosion rate if the pH were to drop to 6.8 or below. However, the Westinghouse response regarding corrosion rates is considered an adequate response to Action Item 1 in the context of “best estimate” assumptions, as required for Resolution Plan GI-AP1000-CE-04.A4.
130. Concerns regarding justification of the corrosion rate have been captured in assessment finding CP-AF-AP1000-CE-04.
131. ONR made the following comment in RQ-AP1000-1686 (Ref. 15):
132. “There needs to be certainty that the accident condition identified in the ALARP Assessment document bounds the temperature and time period for the worst design basis fault event down to the 1 x 10-5 per annum IFF, as specified in the ONR SAPs 2014 (Ref. 5). This should also consider beyond the 60 years reactor operational period to 100 years of in-service operation. There should be clarity about what the accident conditions are and whether the aged CA20 module can maintain its structural integrity.”
133. Westinghouse responded to Comment ID 12 in RQ-AP1000-1686 (Ref. 15) stating that:
Office for Nuclear Regulation Page 26 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
134. “the probabilities of accident thermal (SFP boiling) and safe shutdown earthquakes concurrently are on the order of magnitude of 4.42E-04 per annum and 1E-04 per annum, respectively. The accident thermal condition probability considers the loss of offsite power, along with the loss of the cooling trains for the spent fuel pool cooling system (SFS). Therefore, both the accident thermal and safe shutdown earthquake events occurring together are lower than about 1x10-5 per annum.”
135. Assuming that these values take into account up to 100 years of in-service operation, I consider this response to be adequate and in line with ONR SAP EHA.4. I did not consider it proportionate to investigate the derivation of these initiating event frequencies for bounds of the temperature and time period for the worst design basis fault event.
136. ONR made the following comment in RQ-AP1000-1686 (Ref. 15):
137. “For the accident scenario that is suggested to take place over a 7 day period, while recognising the accident includes a significant temperature rise to boiling in the spent fuel pool, the presumption to use an equivalent corrosion rate of 10μm/year integrated over a theoretical year worth’s duration needs to be substantiated. Regions of the CA20 structure’s reinforcement that indicate a higher utilisation DCR value needs to be substantiated at 60 years, with an extension to at least 75 years, ensuring no cliff-edge effect is present. In addition, the fault scenario is inside the design basis, therefore conservative criteria should be applied; or else some form of other conservative safety justification needs to be provided.”
138. The ALARP assessment (Ref. 13), regarding the availability of corrosion rates for accident conditions (Section 4.1.3.3), states that:
139. “The corrosion rates at the accident thermal conditions are not available, since the information provided within Reference 14 is based on normal condition temperatures… assuming one year worth of corrosion for the accident condition is a reasonable assumption.”
140. Westinghouse claims that under accident conditions the amount of corrosion is limited to an equivalent of a year’s corrosion at a 10 μm rate, with a year’s equivalence spread within the assumed seven-day accident period. I do not consider the 10 μm corrosion rate to be a conservative condition.
141. In addition, I consider that the assumed length of the seven-day transient is not justified as conservative.
The assumed accident period being limited to a seven-day transient is based on successful emergency response arrangements. If the emergency response is not successful, the accident period could be longer.
Resilience against extended site power loss has not been considered.
142. Westinghouse states, concerning the concrete temperature, in Section 4.1.3.3 of the ALARP assessment (Ref. 13), that:
143. “If two accidents were to ever occur, the accident thermal conditions would typically occur for no more than 7 days and most of the concrete section would be below the maximum temperature.”
144. I agree with this statement in terms of the concrete temperature, and it suggests that the corrosion rate will vary depending on the location as the corrosion rate is dependent on the temperature of the borated water. This is acknowledged in Westinghouse’s response in RQ-AP1000-1686 (Ref. 15) stating that:
Office for Nuclear Regulation Page 27 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
145. “The presumption of an equivalent corrosion rate applies to the inside face of the walls where the temperature may approach that of the boiling pool water. The steel plates on the inside surface are Duplex plate and are not subject to corrosion. The carbon steel items where increased corrosion due to the high temperature could reduce the DCR are addressed below.”
146. The regions with high DCR values mentioned in RQ-AP1000-1686 (Ref. 15) are discussed earlier in the report. These comprise the regions with accidental corrosion rates, ie “where the temperature may approach that of the boiling pool water”.
147. Regarding regions away from the boiling pool water, Westinghouse states in RQ-AP1000-1686 (Ref. 15):
148. “Note that the cold face of the pools and the structure below the fuel pools including the carbon steel CA module walls and bottom floor plates are not subject to the pool boiling temperature and additional corrosion of these elements is not discussed further in this response.”
149. I agree with this statement that the regions away from the boiling pool water will not be subject to additional corrosion rates due to elevated thermal effects.
150. The seven-day length corrosion rate of the assumed accident period is not justified as conservative in the context of ONR SAPs 2014 (Ref. 5) (ECE.13) as it is dependent upon successful emergency response arrangements.
151. I consider the Westinghouse responses regarding the accident condition as an adequate response to Action Item 1 in the context of “best estimate” assumptions. Concerns regarding justification of the corrosion rate have been captured in assessment finding CP-AF-AP1000-CE-04.
152. In the submitted Westinghouse ALARP assessment (Ref. 13), there is no consideration of the potential bimetallic effects between the duplex faceplates and connecting carbon steel members. These connections could be susceptible to bimetallic corrosion under certain conditions in the presence of an electrolyte. Westinghouse has confirmed verbally at a level 4 technical engagement that it does not consider bimetallic effects to be a viable corrosion mechanism due to the dry nature (ie no electrolyte) of the connections. I do not consider that Westinghouse has provided suitable justification to ensure that the effects of bimetallic corrosion are negligible as there remains the possibility that bimetallic corrosion effects have a higher rate of corrosion than that used in the assessment work for GI-AP1000-CE- 04.A4, Action Item 1.
Assessment Finding CP-AF-AP1000-CE-06:
The licensee shall demonstrate that the design of the spent fuel pool remains robust in areas where bimetallic corrosion can occur.
153. Westinghouse has undertaken an evaluation of the degradation depth of boric acid into concrete as detailed in the supporting letter “Evaluation of Impact of Boric Acid Leakage on AP1000 Plant Spent Fuel Pool Reinforced Concrete Corrosion and Degradation” (Ref. 14). Section 3.1 (of Ref. 14) describes the basis for its claim and argument while Section 3.2 states:
Office for Nuclear Regulation Page 28 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
154. “CNWRA also conducted one-dimensional (1-D) reactive transport simulations to determine the degree of concrete dissolution and pH change that may occur as boric acid solution diffuses into the matrix of an intact (uncracked) concrete structure; ie, the degradation due to boric acid was diffusion limited (Reference 4). Simulations up to 100 years were performed for 1200 and 2400 ppm B at 77°F (25°C). Table A-3 provides the concrete mineralogy.
The depth of concrete leaching by boric acid solution derived from the 1-D model agreed relatively well with the leaching depth data discussed in Section 3.1. The 1-D simulation results also indicated that leaching by boric acid solution diffusing into concrete is mitigated by the acid-neutralizing capacity of the cement minerals, such that the pH would remain above the threshold for carbon steel corrosion (estimated to be between 6.8 and 7.3) for at least 70 years.”
155. The model used by Westinghouse as evidence that concrete degradation due to boric acid attack is not an issue is based on an unspecified aggregate and the assumption that the concrete remains uncracked. The rate of concrete degradation depends on the cement chemistry and aggregate minerology of the concrete. In addition, the concrete has not been explicitly designed as uncracked and the ALARP assessment (Ref. 13) makes several references to minor cracks within the walls and slabs of the CA20 module. Concrete degradation due to boric acid attack can affect flow rates and therefore steel corrosion rates.
Assessment Finding CP-AF-AP1000-CE-07:
The licensee shall demonstrate that the analysis of the effects of borated water on concrete used in GDA is applicable to the site specific cement chemistry and aggregate minerology.
156. The ALARP assessment (Ref. 13) regarding corrosion of reinforcement and maximum DCRs (Section 4.4.3.1) states that:
157. “For the reinforcing bar along the wall, leakage through the gap between the liner and the concrete can subject an entire vertical row of reinforcement to corrosion from boric acid leakage”… “it was determined that leakage will not cause local failure of the structure from corrosion of reinforcing bar. The same assessment is performed for this case, since the wall is of similar construction, and the maximum DCR (design to capacity ratios) for Wall N is greater than the North Wall of the spent fuel pool (Wall 4). For note, the maximum DCR for Wall N is 0.983 and the maximum DCR for Wall 4 is 0.72.”
158. For a design situation, a conservative approach should be used in line with ONR SAPs. The percentage utilisation of the reinforcement for the structures and connecting parts under the structural design conditions is expressed using DCRs. As stated above, DCRs have been determined for Wall N of 0.983 and Wall 4 of 0.72. Assuming that these DCRs were calculated based on a corrosion rate of 10 μm/year, if the corrosion rate is greater, or demonstrably conservative, then any DCRs approaching a DCR of 1.0 in the CA20 structure would need to be reanalysed for their design acceptability. Hence, in terms of design acceptance, any possible ‘cliff-edge’ effect on the structural integrity would be predicted.
159. Westinghouse’s response to RQ-AP1000-1686 (Ref. 15) regarding the high DCRs states that they were calculated conservatively:
Office for Nuclear Regulation Page 29 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
160. “These DCRs are based on structural design criteria and analyses that assume conservatively that the maximum response to the SSE and the maximum accident thermal response occur concurrently”… “Since the maximum accident thermal response occurs many hours after the initiation of the accident, these are two independent events and do not need to be combined.”
161. I agree that this is an onerous condition and that these events would be unlikely to occur simultaneously. Hence, I consider the response concerning the high DCRs due to the loss of reinforcement through corrosion to be satisfactory, based on “best estimate” corrosion rates, as required for Resolution Plan GI-AP1000-CE-04.A4, Action Item 1. The response is in line with ONR SAPs ECE.6, ECE.12 and ECE.13.
162. ONR made the following comment in RQ-AP1000-1686 (Ref. 15):
163. “The present ALARP Assessment logic includes an assumption that it is not expected for any more than just one rebar to be affected by boric acid solution without first coming into contact with concrete (Section 4.2.1.2):
“From the spacing of the rebar described above and the large concrete cover to the reinforcement, it is not expected that any more than one (1) rebar will be in contact with the boric acid without first coming into contact with concrete.”
It is further assumed that:
“If an accident condition were to occur, the amount of additional leakage will cause an additional 10μm of corrosion on the carbon steel. Since the amount of additional cracking is small and would generally not occur on the hot face of the wall, another rebar would not be impacted as a result of the additional leakage during accident conditions.”
This set of assumptions needs to be better substantiated, especially at regions of reinforcement with higher utilisation DCR levels.”
164. Westinghouse’s response to Comment ID 10 in RQ-AP1000-1686 (Ref. 15) looked at the regions of the design that would be affected by the assumption that corrosion will take place of only one full rebar and recalculated the DCRs according to the loss of more than one reinforcement bar or shear stud in order to justify the acceptability of the design. Westinghouse provided justification for the following locations:
studs and angles welded to the Duplex steel plate of the CA module walls above the pool floors
top reinforcement in the CA module floor including the dowel bars extending into the east and west walls
inside face reinforcement of the RC Walls N and 4
inside face dowel bars connecting the CA walls to the RC walls
165. In Westinghouse’s response (Ref. 15), it also stated in conclusion for the above justifications that there would be “no cliff-edge failures” as a result of loss of reinforcement bars or studs. This conclusion is based on the calculations demonstrating sufficient margin for the DCRs at each location.
166. I did not consider it proportionate to undertake a review of the detailed calculations that considered the removal of additional bars or studs to determine the DCR magnitudes presented (in Ref. 15). However, the calculations indicate sufficient margin in terms of
Office for Nuclear Regulation Page 30 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
the possibility of “no cliff-edge failures” as a result of loss of reinforcement bars or studs. In addition, Westinghouse also suggested credible additional conservatisms within the description of each justification. I judge the Westinghouse response to Resolution Plan GI-AP1000-CE-04.A4, Action Item 2, to satisfy ONR SAPs ECE.6, ECE.12 and ECE.13.
167. During my assessment, I identified five items for a future licensee to take forward in their site-specific safety submissions. Details of these are contained in Annex 1.
168. These matters do not undermine the generic safety submission and are primarily concerned with the provision of site-specific safety case evidence, which will usually become available as the project progresses through the detailed design, construction and commissioning stages. These items are captured as Assessment Findings.
169. Residual matters are recorded as Assessment Findings if one or more of the following apply:
site-specific information is required to resolve this matter;
the way to resolve this matter depends on licensee design choices;
the matter raised is related to operator-specific features / aspects / choices;
the resolution of this matter requires licensee choices on organisational matters;
to resolve this matter, the plant needs to be at some stage of construction / commissioning.
170. During my assessment, I identified no items as minor shortfalls in the Westinghouse responses to the GDA issue.
171. Residual matters are recorded as a minor shortfall if it does not:
undermine ONR’s confidence in the safety of the generic design;
impair ONR’s ability to understand the risks associated with the generic design;
require design modifications;
require further substantiation to be undertaken.
Office for Nuclear Regulation Page 31 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
172. This report presents the findings of the assessment of GDA Issue GI-AP1000-CE-04 relating to the AP1000 GDA closure phase. My assessment conclusions are:
Westinghouse’s response has demonstrated that its design incorporates a suitable leak detection/collection system to the secondary barrier formed by the steel concrete composite (SC) construction in the CA20 walls and floors.
Westinghouse’s response has demonstrated that its design incorporates a suitable leak detection / collection system to the secondary barrier formed by the reinforced concrete wall which is cast up against the single plate stainless steel liner to the west wall of module CA20.
Westinghouse’s response has demonstrated that their design incorporates a suitable leak detection/collection system to the secondary barrier formed by the RC wall which is cast between the north single plate stainless steel liner of the SFP and the shield building.
Westinghouse has adequately evaluated the effect of borated water from potential leakage from SFP on mild steel components within the CA20 module. Westinghouse has undertaken a suitable evaluation on the potential of the corrosion rates of mild steel reinforcing bars subject to potential leaks from the pools and an evaluation of the effects on the structural capacity of the same walls and slabs.
173. To conclude, I judge that Westinghouse’s submission:
adequately justifies its position in regard to ONR’s expectations for containment leak detection and collection in the fuel handling area; and
adequately demonstrates that reasonably foreseeable risks as a result of implementing the proposed design have either been reduced to levels that are ALARP, or that a licensee may implement adequate arrangements to further reduce risk ALARP.
174. I consider that from a CE viewpoint on the fuel handling area secondary containment leak detection and collection system, the AP1000 design is suitable for construction in the UK.
Office for Nuclear Regulation Page 32 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
1. Westinghouse AP1000® Generic Design Assessment, GDA Issue, Fuel Handling Area – Secondary Containment Leak Detection and Collection System, GI-AP1000-CE-04 Revision 0, TRIM Ref. 2011/369288.
2. UK AP1000 Assessment Plan for Closure GDA Civil Engineering Issues 1 to 4, Assessment Plan ONR-GDA.-AP-14-008 Revision 2, TRIM Ref. 2015/149237.
3. Westinghouse UK AP1000® Generic Design Assessment Resolution Plan for GI-AP1000-CE-04, Revision 5, TRIM Ref. 2015/89852.
4. Office for Nuclear Regulation (ONR), Guidance on Mechanics of Assessment, TRIM Ref. 2013/204124.
5. Safety Assessment Principles for Nuclear Facilities, Revision 0, 2014 Edition. www.onr.org.uk/saps/index.htm.
6. ONR Technical Assessment Guides. www.onr.org.uk/operational/tech_asst_guides/index.htm.
7. Westinghouse Electric Company, AP1000® Plant ALARP Assessment of Structural Impact from Fuel Handling Area Pools Leakage, UKP-GW-GL-799, Revision 0, 23 December 2015, TRIM Ref. 2016/264240.
8. Westinghouse Electric Company, Response to TQ-AP1000-1218, Spent Fuel Pond – Civil Engineering hazard barriers claimed against potential leaking of water from the pond, 21 January 2011, TRIM Ref. 2011/48236.
9. Westinghouse Electric Company, Response to TQ-AP1000-1270, Spent Fuel Pond – claims made on leak chases as leak prevention barrier, 15 February 2011, TRIM Ref. 2011/100072.
10. Westinghouse Electric Company, UK AP1000 Environmental Report, UKP-GW-GL-790, Revision 5A, 13 November 2015, TRIM Ref. 2015/431548.
11. Westinghouse Electric Company, GDA Issues CE-04 ALARP Assessment of Secondary Containment Leakage (1 of 2), Response to RQ-AP1000-1569, 30 June 2016, TRIM Ref. 2016/264226.
12. Westinghouse Electric Company, GDA Issues CE-04 ALARP Assessment of Secondary Containment Leakage (2 of 2), Response to RQ-AP1000-1574, 30 June 2016, TRIM Ref. 2016/264236.
13. Westinghouse Electric Company, AP1000® Plant ALARP Assessment of Structural Impact from Fuel Handling Area Pools Leakage, UKP-GW-GL-799, Revision 1, 30 June 2016, TRIM Ref. 2016/264240.
14. Westinghouse Electric Company, Evaluation of Impact of Boric Acid Leakage on AP1000 Plant Spent Fuel Pool Reinforced Concrete Corrosion and Degradation, LTR-CCOE-15-35, Revision 0, 12 June 2015, TRIM Ref. 2016/78644.
15. Westinghouse Electric Company, Further Clarifications Required for the Response to CE-04, Response to RQ-AP1000-1686, 10 October 2016, TRIM Ref. 2016/394266.
16. Westinghouse Electric Company, Response to Action Items from GDA Civil Engineering Meeting, DCP_JNE_000496, 9 January 2011, TRIM Ref. 2011/22886.
Office for Nuclear Regulation Page 33 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
17. NS-PER-GD-014 Revision 5, Purpose and Scope of Permissioning, August 2015, TRIM Ref. 2015/304735.
18. Arup, Provision of Support on Civil Engineering Safety Assessment for the Resolution of GDA Issues of the UK AP1000 Nuclear Power Plant – ONR275, CE-04.A1-A4: Leak Detection and Collection System, 247462-CE-04.A1-A4, November 2016.
19. American Society of Mechanical Engineers, ASME Boiler and Pressure Vessel Code – Division 1 – Rules for Construction of Pressure Vessels, Section VIII – Pressure Vessels, 2001.
20. American Bureau of Shipping, Rules for Building and Classing: Floating Production Installations 2014, ABS, July 2014.
21. G.W. Jordan and A.P. Mann, THORP Receipt & Storage: design and construction, The Structural Engineer, Volume 68/No.1/9, January 1990.
22. Westinghouse Electric Company, AP1000® Plant ALARP Assessment of Structural Impact from Fuel Handling Area Pools Leakage, UKP-GW-GL-799, Revision 2, 9 August 2016, TRIM Ref. 2017/317277.
23. Westinghouse Electric Company, UK AP1000 Environmental Report, UKP-GW-GL-790, Revision 6, 27 January 2017, TRIM Ref. 2017/36981.
Office for Nuclear Regulation Page 34 of 35 Report ONR-NR-AR-16-042 TRIM Ref: 2016/274973
Annex 1 Assessment Findings to be addressed during the Forward Programme – GDA issue GI-AP1000-CE-04
Assessment Finding Number Assessment Finding Report Section Reference CP-AF-AP1000-CE-03 The licensee shall demonstrate that the design satisfies the two barrier 4.2.3 principle at joints between the floor liner plates in the half steel-concrete composite floors. CP-AF-AP1000-CE-04 The licensee shall provide a conservative analysis of the corrosion rate used 4.3.1 & 4.5.1 to assess the effects of highly borated water on steel reinforcement in the SFP. If this analysis shows insufficient resilience in the structure the licensee shall investigate and develop options for testing and repair. CP-AF-AP1000-CE-05 The licensee shall establish a site-specific groundwater monitoring 4.3.1 programme and model that includes information from the Westinghouse ALARP Assessment and Westinghouse Environmental Report for the full life cycle of the facility. CP-AF-AP1000-CE-06 The licensee shall demonstrate that the design of the spent fuel pool remains 4.5.2 robust in areas where bimetallic corrosion can occur. CP-AF-AP1000-CE-07 The licensee shall demonstrate that the analysis of the effects of borated 4.5.2 water on concrete used in GDA is applicable to the site specific cement chemistry and aggregate minerology.
Office for Nuclear Regulation Page 35 of 35